{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12069", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-22T13:54:39.633Z", "datePublished": "2025-11-04T03:26:47.094Z", "dateUpdated": "2026-04-08T17:27:25.458Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:25.458Z"}, "affected": [{"vendor": "stiand", "product": "WP Global Screen Options", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing nonce validation on the `updatewpglobalscreenoptions` action handler. This makes it possible for unauthenticated attackers to modify global screen options for all users via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "title": "WP Global Screen Options <= 0.2 - Cross-Site Request Forgery to Screen Options Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dae86d7c-3bbb-4872-acd7-08ff8d437b8e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-global-screen-options/tags/0.2/wp_global_screen_options.php#L16"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-11-03T15:18:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T18:47:51.593719Z", "id": "CVE-2025-12069", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T18:48:00.111Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12069", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T18:47:51.593719Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T18:47:56.216Z"}}], "cna": {"title": "WP Global Screen Options <= 0.2 - Cross-Site Request Forgery to Screen Options Update", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "stiand", "product": "WP Global Screen Options", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T15:18:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dae86d7c-3bbb-4872-acd7-08ff8d437b8e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-global-screen-options/tags/0.2/wp_global_screen_options.php#L16"}], "descriptions": [{"lang": "en", "value": "The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing nonce validation on the `updatewpglobalscreenoptions` action handler. This makes it possible for unauthenticated attackers to modify global screen options for all users via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:25.458Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12069", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:25.458Z", "dateReserved": "2025-10-22T13:54:39.633Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T03:26:47.094Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing nonce validation on the `updatewpglobalscreenoptions` action handler. This makes it possible for unauthenticated attackers to modify global screen options for all users via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-12069", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-04T04:15:37.270", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-global-screen-options/tags/0.2/wp_global_screen_options.php#L16"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dae86d7c-3bbb-4872-acd7-08ff8d437b8e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:40:11.146297+00:00", "value": {"mitigation_remediation": ["Update the WP Global Screen Options plugin to a version newer than 0.2, or uninstall the plugin if no upgrade exists.", "If an immediate update is not possible, remove or disable the updatewpglobalscreenoptions hook, or restrict it to users with the admin capability to prevent unauthorized changes.", "Deploy a firewall or security plugin rule to block forged POST requests targeting the updatewpglobalscreenoptions action, ensuring only legitimate, non-privileged requests are accepted."], "summary": {"action": "Patch Now", "impact": "Unauthenticated Cross\u2011Site Request Forgery modifies global screen options for all users"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the WP Global Screen Options plugin by stiand installed, versions 0.2 and earlier are affected.", "description_and_impact": "The WP Global Screen Options plugin has a missing nonce check in its administrative action handler, which allows an unauthenticated attacker to send a forged request that changes the global screen options for every user. The change does not reveal sensitive data but can alter the user interface and workflow for all administrators and site users. The weakness is a Cross\u2011Site Request Forgery flaw, identified as CWE\u2011352.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity and the EPSS score is below 1%, pointing to a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to lure an administrator into clicking a crafted link or submitting a form that triggers the vulnerable action; no administrator credentials are required, but the attack relies on user interaction. The likely attack vector involves an administrator clicking a malicious link, which is inferred from the description. Because the impact is limited to interface configuration and does not grant direct data access or code execution, the overall risk is moderate but warrants timely remediation."}}}}, "created": "2025-11-04T16:33:30.821389+00:00", "updated": "2026-04-22T00:45:04.159508+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}